CVE-2019-11279highCWE-77

CVE-2019-11279: falha de alta gravidade em Cloud Foundry UAA Release (OSS)

Privilege Escalation via Scope Manipulation in UAA

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar UAA

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 1.3%
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Produtos afetados
Cloud Foundry · UAA Release (OSS)
CVEs relacionadas — Cloud Foundry UAA Release (OSS)

No mesmo produto, das mais perigosas para as menos.

CVE-2019-11278HIGHPrivilege Escalation via Blind SCIM Injection in UAAEPSS 1.3%CVE-2019-11270HIGHUAA clients.write vulnerabilityEPSS 1.1%CVE-2019-3787HIGHUAA defaults email address to an insecure domainEPSS 1.1%CVE-2019-3794MEDIUMUAA - Login app subject to clickjacking attackEPSS 1.1%CVE-2019-11268MEDIUMUAA SQL Identity Zone VulnerabilityEPSS 1.0%CVE-2019-3775HIGHUAA allows users to modify their own email addressEPSS 0.9%